CVE-2014-2369: Omron NS Series HMI Cross-Site Request Forgery

Published Jul 24, 2014

Updated

Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Affected Software

14 affected components

Omron Ns Series System Program Firmware=8.1

Omron Ns Series System Program Firmware=8.68

Omron Ns10 Hmi Terminal

Omron Ns12 Hmi Terminal

Omron NS15 HMI terminal

Omron Ns5 Hmi Terminal

Omron Ns8 Hmi Terminal

All of the following

Any of the following

Omron Ns Series System Program Firmware=8.1

Omron Ns Series System Program Firmware=8.68

Any of the following

Omron Ns10 Hmi Terminal

Omron Ns12 Hmi Terminal

Omron NS15 HMI terminal

Omron Ns5 Hmi Terminal

Omron Ns8 Hmi Terminal

Remediation

Information

Omron Corporation has produced update, Version 8.69x for Japan and Version 8.7x for other countries, that mitigates the identified vulnerabilities. The updates for the NS series of HMI terminals can be downloaded at the following locations: NS15 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html NS12 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html NS10 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html NS8 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html NS5 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html

Event History

Jul 24, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2369?

CVE-2014-2369 is classified as a critical vulnerability due to the potential for unauthorized access and control.

How do I fix CVE-2014-2369?

To mitigate CVE-2014-2369, update the firmware of affected Omron NS series HMI terminals to a version that addresses this vulnerability.

What types of devices are affected by CVE-2014-2369?

CVE-2014-2369 affects Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals running firmware versions 8.1 to 8.68.

What is the nature of the vulnerability described in CVE-2014-2369?

CVE-2014-2369 is a cross-site request forgery (CSRF) vulnerability that allows attackers to hijack user authentication.

Who is at risk from CVE-2014-2369?

Users of the affected Omron NS series terminals, particularly those with remote authenticated access, are at risk from CVE-2014-2369.